From 6080ea098d97393da32c6f66eb95c7144620298c Mon Sep 17 00:00:00 2001 From: Linos Giannopoulos Date: Fri, 5 Jul 2019 17:48:07 +0300 Subject: [PATCH] libcurl: Restrict redirect schemes All protocols except for CURLPROTO_FILE/CURLPROTO_SMB and their TLS counterpart were allowed for redirect. This vastly broadens the exploitation surface in case of a vulnerability such as SSRF [1], where libcurl-based clients are forced to make requests to arbitrary hosts. For instance, CURLPROTO_GOPHER can be used to smuggle any TCP-based protocol by URL-encoding a payload in the URI. Gopher will open a TCP connection and send the payload. Only HTTP/HTTPS and FTP are allowed. All other protocols have to be explicitly enabled for redirects through CURLOPT_REDIR_PROTOCOLS. [1]: https://www.acunetix.com/blog/articles/server-side-request-forgery-vulnerability/ Signed-off-by: Linos Giannopoulos Closes #4094 --- lib/url.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/lib/url.c b/lib/url.c index 22b930015..258f60c8f 100644 --- a/lib/url.c +++ b/lib/url.c @@ -488,9 +488,7 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data) define since we internally only use the lower 16 bits for the passed in bitmask to not conflict with the private bits */ set->allowed_protocols = CURLPROTO_ALL; - set->redir_protocols = CURLPROTO_ALL & /* All except FILE, SCP and SMB */ - ~(CURLPROTO_FILE | CURLPROTO_SCP | CURLPROTO_SMB | - CURLPROTO_SMBS); + set->redir_protocols = CURLPROTO_HTTP | CURLPROTO_HTTPS | CURLPROTO_FTP; #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) /* -- 2.40.0